KaxBlock: do not attempt to use laced sizes that are clearly invalid

diff --git a/src/KaxBlock.cpp b/src/KaxBlock.cpp
index 878d9a225382edc742128cba6080b3d3c2c88d79..b5972e835457e71a31fa4a6d6ce989de6db00a68 100644 (file)
--- a/src/KaxBlock.cpp
+++ b/src/KaxBlock.cpp
@@ -628,11 +628,12 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
       // put all Frames in the list
       if (mLacing != LACING_NONE) {
         // read the number of frames in the lace
-        uint32 LastBufferSize = GetSize() - BlockHeadSize - 1; // 1 for number of frame
+        const uint32 TotalLacedSize = GetSize() - BlockHeadSize - 1; // 1 for number of frame
+        uint32 LastBufferSize = TotalLacedSize;
         uint8 FrameNum = _TempHead[0]; // number of frames in the lace - 1
         // read the list of frame sizes
         uint8 Index;
-        int32 FrameSize;
+        uint32 FrameSize;
         uint32 SizeRead;
         uint64 SizeUnknown;
 
@@ -646,6 +647,8 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
               do {
                 Result += input.read(_TempHead, 1);
                 FrameSize += uint8(_TempHead[0]);
+                if (FrameSize > TotalLacedSize)
+                  throw SafeReadIOCallback::EndOfStreamX(0);
                 LastBufferSize--;
 
                 FirstFrameLocation++;
@@ -662,6 +665,8 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
             cursor = _tmpBuf = new binary[FrameNum*4]; /// \warning assume the mean size will be coded in less than 4 bytes
             Result += input.read(cursor, FrameNum*4);
             FrameSize = ReadCodedSizeValue(cursor, SizeRead, SizeUnknown);
+            if (FrameSize > TotalLacedSize)
+              throw SafeReadIOCallback::EndOfStreamX(0);
             SizeList[0] = FrameSize;
             cursor += SizeRead;
             LastBufferSize -= FrameSize + SizeRead;
@@ -670,6 +675,8 @@ filepos_t KaxInternalBlock::ReadData(IOCallback & input, ScopeMode ReadFully)
               // get the size of the frame
               SizeRead = LastBufferSize;
               FrameSize += ReadCodedSizeSignedValue(cursor, SizeRead, SizeUnknown);
+              if (FrameSize > TotalLacedSize)
+                throw SafeReadIOCallback::EndOfStreamX(0);
               SizeList[Index] = FrameSize;
               cursor += SizeRead;
               LastBufferSize -= FrameSize + SizeRead;